At Totumix, we take your privacy seriously. This policy describes what data we collect, how we use it, and your rights regarding your personal information.
1. Information We Collect
Account Information: When you register, we collect your name, email address, and password (hashed and encrypted). We may also collect optional profile information you provide.
Usage Data: We collect information about how you interact with Totumix, including pages visited, features used, session timestamps, and IP addresses for security and analytics purposes.
Payment Information: Billing and payment data is processed exclusively by Lemon Squeezy, our payment processor. Totumix does not store your full card details. We receive only a transaction reference and subscription status.
Generated Content: Prompts you submit, images you upload, and outputs generated through our AI systems are temporarily processed on our servers and may be retained for up to 30 days for quality assurance unless you request deletion.
Cookies & Local Storage: We use browser local storage to preserve your session preferences (such as dark/light mode and credit balances) and standard session cookies for authentication managed by Supabase.
2. How We Use Your Information
To provide and operate the Totumix platform, including AI image generation and prompt extraction services.
To manage your account, subscription, and credit balance.
To communicate with you about account activity, service updates, and promotional offers (you may opt out at any time).
To detect, prevent, and address abuse, fraud, security incidents, and technical problems.
To comply with applicable legal obligations and enforce our Terms of Service.
To perform internal analytics and improve the functionality, performance, and features of our platform.
3. How We Share Your Information
Service Providers: We share data with trusted third-party vendors who help us operate the platform, including Supabase (authentication), Lemon Squeezy (payments), and hosting infrastructure providers. These vendors are contractually obligated to protect your data.
Legal Compliance: We may disclose information to law enforcement, government authorities, or other parties when required by applicable law or to protect the rights, property, or safety of Totumix, our users, or the public.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
4. Data Retention
We retain your account data for as long as your account remains active or as needed to provide services.
Generated images and prompts are stored temporarily (up to 30 days) unless you delete them sooner.
Upon account deletion, we will remove your personal data within 30 days, except where retention is required by law.
Anonymized, aggregated analytics data may be retained indefinitely.
5. Your Rights & Choices
Access & Portability: You may request a copy of the personal data we hold about you.
Correction: You may update or correct your account information at any time through your profile settings.
Deletion: You may request deletion of your account and associated data by contacting us at privacy@totumix.com.
Opt-Out: You may opt out of marketing emails by clicking "Unsubscribe" in any email, or by updating your notification preferences.
California Residents (CCPA): You have the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.
EU/UK Residents (GDPR/UK GDPR): You have the right to access, rectify, erase, restrict processing, and port your data, and to object to processing based on legitimate interests.
6. Data Security
We implement industry-standard security measures including encryption in transit (TLS 1.2+), encrypted storage, access controls, and regular security audits.
Authentication is managed by Supabase, which provides enterprise-grade security including multi-factor authentication and brute-force protection.
Despite our safeguards, no Internet transmission is 100% secure. We cannot guarantee absolute security but commit to promptly notifying you of any confirmed breach affecting your data.
7. Cookies & Tracking Technologies
Essential Cookies: Used for authentication session management. These are required for the platform to function and cannot be disabled.
Analytics Cookies: We may use anonymized analytics tools to understand platform usage. These do not track personal identifiers.
Local Storage: We use browser local storage to persist your UI preferences (theme, sidebar state) locally on your device.
You may disable cookies in your browser settings, but this may affect functionality.
8. Third-Party Links & Services
The platform may contain links to third-party websites or integrate third-party services. This Privacy Policy applies only to Totumix. We encourage you to review the privacy policies of any third-party services you interact with.
9. Children's Privacy
Totumix is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@totumix.com and we will promptly delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or a prominent notice on the platform at least 14 days before the change takes effect.
Your continued use of Totumix after changes become effective constitutes acceptance of the updated policy.
11. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Email: privacy@totumix.com
Mailing Address: Totumix Inc., Legal Department, [Address on File]
We aim to respond to all inquiries within 5 business days.